12 TYPO3 Security Mistakes You Might Be Making

Encryption of confidential information (especially important for e-commerce)

• Trust indicator
• A rise in SEO rankings

Once an SSL certificate is installed, it encrypts username and passwords too, which secures your login area, making hacker entry near-impossible. This improves credibility and trustworthiness which are both essential for businesses looking to sell products or generate leads online.

Just like the TYPO3 core version, your themes and plugins should have regular updates for bug fixes and security patches. It’s your job to test these updates then install them to keep your TYPO3 website safe.

In fact, vulnerable plugins and themes account for 51 percent of all hacked websites. Consequently, you’d do well to keep them up to date in order to minimize security risks.

Granting unrestricted access to all users can make it easier for hackers to break in.

Editor level access should be granted only to trusted users, and Admin level access can be granted, if at all, very sparingly. Allowing limited privileges to users and forcing them to use strong passwords can control access to the backend to a large extent.

Having unused or inactive extensions and themes are on your website is a major TYPO3 security mistake. One of the primary blunders that most business owners do not realize is the hoarding of new templates, extensions, or user accounts. Of course, you need to keep on adding plugins as per business needs. But once you are done with a particular plugin, do not just deactivate or disable it, go ahead and remove it completely from your TYPO3 site.

Though these idle plugins do not use RAM or bandwidth, they use server space. This affects site performance, resulting in slow speed.

The same goes for themes and user accounts too. Each idle user account is a platform for brute force attacks. It is best that your website is simple and not stuffed with these unused themes and plugins. Hence to minimize the risk effectively, it is best to reduce their number.

• Go through all the plugins and delete all the deactivated ones.
• The same procedure applies to themes too.
• After completing the clean-up process, take a step further and go for a decluttering process.
• Delete unpublished draft posts, unused pages, and other old posts for minimizing the size of your site database.
• Delete all unused tags, categories, and spam comments.
• Go to your media library and delete identical or unattached images.

Be merciless in deleting all idle and unnecessary stuff and keep your site healthy and risk-free.

Not all web hosts are created equal, and choosing one solely on price can end up costing you way more in the long run with TYPO3 security mistakes.

Most shared hosting environments are secure, but some do not properly separate user accounts. If user accounts aren’t properly separated, a single compromised account could take down every website on that shared server.

Your host should be vigilant about applying the latest security patches and following other important hosting security best practices related to server and file security.

Passwords like ‘password1234,’ ‘qwerty,’ ‘admin’ are all too common and way too simple. It takes just seconds to brute force or manually guess weak passwords, thus only taking attackers seconds to get into your account.

We highly recommend taking the following measure to stop using weak passwords:

• Create Strong Complex Passwords: 

Your passwords should consist of more than 10 characters, with at least one number, one symbol, and one uppercase character.

• Limit the number of users with administration rights:

TYPO3 has different levels of user roles for good reason. Not everyone should be able to do whatever they want. To make your site more secure, it’s a good idea to give everyone just as much permission as they need.

• Install Popular EXT:be_secure_pw:

This extension gives you the possibility to force secure passwords from your BE users. You can set up the password patterns like e.g. capitals, digits, etc. and a minimal length of the password. After activating the extensions, your BE users must fit the patterns and the length of the password to save a new one! 

We’re all human and mistakes happen. Sometimes important security decisions are simply overlooked or forgotten about, so it’s always a good idea to revisit your TYPO3 site and check on its current security posture.

We hope that providing you with these 12 TYPO3 security mistakes will encourage you to check on your site and make sure you are following the best practices associated with a secure TYPO3 environment. 

If this becomes too much for you to handle, you may need to get help from a professional TYPO3 support team. Feel free to reach out to us and learn how we can handle your security, maintenance, and updates.

And if you have any questions or comments, drop us a line down below.